Per discussion in today's retro, engineering would like to make it harder to cherrypick/backport changes into the stable 3.yy branches, so that all changes landing there are:

• approved by stakeholders as urgent or blocking the upcoming downstream release
• pass required automated tests

To avoid potential problems with "no one is available to approve an urgent change" due to TZs or PTO, I would strongly advise allowing the "code owner can override and merge anyway" option.

Describe the solution you'd like

1. enable branch protections on all the che-incubating, eclipse-che, and devfile repos that are relevant for Che and Dev Spaces releases.

Repos to consider:

• https://github.com/redhat-developer/devspaces
• https://github.com/redhat-developer/devspaces-images
• https://github.com/redhat-developer/devspaces-chectl
• https://github.com/devspaces-samples/ (only the projects currently in the devfile registry, see https://github.com/redhat-developer/devspaces/tree/devspaces-3-rhel-8/dependencies/che-devfile-registry/devfiles )
• https://github.com/redhat-developer/devspaces-vscode-extensions

Others to consider?

• https://github.com/redhat-developer/devspaces-demo
• https://github.com/redhat-developer/devspaces-interop-tests
• https://github.com/redhat-developer/devspaces-jiralint

2. adjust existing PR check GH actions to run on BOTH devspaces-3-rhel-8 and devspaces-3.yy-rhel-8 branches

3. Note that authorized bot users should be able to merge without approvals as long as tests pass.

Additional context

Retrospective: https://docs.google.com/drawings/d/1IdeWj4KogB-AvUqmNDstlR_HPMngmSbYBlhVFs0kIKk/edit 
Upstream: https://github.com/eclipse/che/issues/22558